Remove the repeated ',' from string

Link: https://lore.kernel.org/linux-media/20220704022807.3215-1-zeming@nfschina.com
Signed-off-by: Li zeming <zeming@nfschina.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

There is a for-loop that initializes variable i but does not use it; the
assignment is redundant and can be removed. The proceeding assignment to
pointer fw can also be moved into the for-loop to clean up the code.

Link: https://lore.kernel.org/linux-media/20220628152451.184416-1-colin.i.king@gmail.com
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

fix a coccinelle warning by replacing opencoded max()
implementation with max()

WARNING opportunity for max()

Link: https://lore.kernel.org/linux-media/YrNFpF2qvTxpZP8e@karthik-strix-linux.karthek.com
Signed-off-by: Karthik Alapati <mail@karthek.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

Remove the repeated word 'and' from comments

file: drivers/staging/media/atomisp/pci/hive_isp_css_include/host/debug_public.h
line: 28

* The buffer has a remote and and a local store

changed to:

* The buffer has a remote and a local store

Link: https://lore.kernel.org/linux-media/20220622143442.16942-1-jiangjian@cdjrlc.com
Signed-off-by: Jiang Jian <jiangjian@cdjrlc.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

As the code comment already suggests, using the efivar API in this way
is not how it is intended, and so let's switch to the right one, which
is simply to call efi.get_variable() directly after checking whether or
not the GetVariable() runtime service is supported.

Link: https://lore.kernel.org/linux-media/20220620100819.1682995-1-ardb@kernel.org
Cc: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

ia_css_rmgr_acq_vbuf() uses a local on stack
"struct ia_css_rmgr_vbuf_handle v" variable.

When this path using this is hit, either the rmgr_pop_handle() call
will make *handle point to another vbuf-handle, or because
v.count == 0, ia_css_rmgr_refcount_retain_vbuf() will alloc a new
vbuf-handle and make *handle point to it.

So on leaving the function *handle will never point to the on stack
vbuf-handle, but gcc does not know this and emits the following:

drivers/staging/media/atomisp/pci/runtime/rmgr/src/rmgr_vbuf.c: In function ‘ia_css_rmgr_acq_vbuf’:
drivers/staging/media/atomisp/pci/runtime/rmgr/src/rmgr_vbuf.c:276:33: warning: storing the address of local variable ‘h’ in ‘*handle’ [-Wdangling-pointer=]
  276 |                         *handle = &h;
      |                         ~~~~~~~~^~~~
drivers/staging/media/atomisp/pci/runtime/rmgr/src/rmgr_vbuf.c:257:40: note: ‘h’ declared here
  257 |         struct ia_css_rmgr_vbuf_handle h;
      |                                        ^
drivers/staging/media/atomisp/pci/runtime/rmgr/src/rmgr_vbuf.c:257:40: note: ‘handle’ declared here

Rework the code using a new_handle helper to suppress this
false-postive compiler warning.

Link: https://lore.kernel.org/linux-media/20220612160556.108264-4-hdegoede@redhat.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

When ia_css_rmgr_acq_vbuf() enters the code path where it uses the local
"struct ia_css_rmgr_vbuf_handle v" on the stack it relies on v.count==0
so that ia_css_rmgr_refcount_retain_vbuf allocates a new handle.

Explicitly set v.count to 0 rather then it being whatever was on the stack.

Link: https://lore.kernel.org/linux-media/20220612160556.108264-3-hdegoede@redhat.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

The gcc is warning about returning a pointer to a local variable
is a false positive.

The type of handle is "struct ia_css_rmgr_vbuf_handle **" and
"h.vptr" is left to NULL, so the "if ((*handle)->vptr == 0x0)"
check always succeeds when the "*handle = &h;" statement which
gcc warns about executes. Leading to this statement being executed:

	rmgr_pop_handle(pool, handle);

If that succeeds,  then *handle has been set to point to one of
the pre-allocated array of handles, so it no longer points to h.

If that fails the following statement will be executed:

	/* Note that handle will change to an internally maintained one */
	ia_css_rmgr_refcount_retain_vbuf(handle);

Which allocated a new handle from the array of pre-allocated handles
and then makes *handle point to this. So the address of h is actually
never returned.

The fix for the false-postive compiler warning actually breaks the code,
the new:

	**handle = h;

is part of a "if (pool->copy_on_write) { ... }" which means that the
handle where *handle points to should be treated read-only, IOW
**handle must never be set, instead *handle must be set to point to
a new handle (with a copy of the contents of the old handle).

The old code correctly did this and the new fixed code gets this wrong.

Note there is another patch in this series, which fixes the warning
in another way.

Link: https://lore.kernel.org/linux-media/20220612160556.108264-2-hdegoede@redhat.com
Fixes: fa1451374ebf ("media: atomisp: don't pass a pointer to a local variable")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

The info->data is dereferencing before null checking, so move
it after checking.

Link: https://lore.kernel.org/linux-media/1653897481-25681-1-git-send-email-baihaowen@meizu.com
Signed-off-by: Haowen Bai <baihaowen@meizu.com>
Reviewed-by: Tommaso Merciai <tommaso.merciai@amarulasolutions.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

The three bugs are here:
	__func__, s3a_buf->s3a_data->exp_id);
	__func__, md_buf->metadata->exp_id);
	__func__, dis_buf->dis_data->exp_id);

The list iterator 's3a_buf/md_buf/dis_buf' will point to a bogus
position containing HEAD if the list is empty or no element is found.
This case must be checked before any use of the iterator, otherwise
it will lead to a invalid memory access.

To fix this bug, add an check. Use a new variable '*_iter' as the
list iterator, while use the old variable '*_buf' as a dedicated
pointer to point to the found element.

Link: https://lore.kernel.org/linux-media/20220414041415.3342-1-xiam0nd.tong@gmail.com
Cc: stable@vger.kernel.org
Fixes: ad85094b293e4 ("Revert "media: staging: atomisp: Remove driver"")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>